Subject: [pcp] PCP Authentication *Technique* Requirements

From: Ben McCann <[email-masked]>
Date: Fri, 14 Jun 2013 14:48:17 -0400

draft-reddy-pcp-auth-03 defines about 14 requirements for the PCP 
authentication protocol. These requirements don't include any discussion 
about the cryptographic strength or user identity model of the 
authentication techniques(s) used within PCP authentication.

The current requirements are too vague on this point because, I think, 
there's an assumption in the WG that PCP authentication will be based on 
EAP. I agree. I don't think the PCP WG should invent authentication 
techniques.

So, I suggest we change the following recommendation:

    REQ-11:  It is RECOMMENDED to choose a widely deployed authentication
       technique with known security properties rather than inventing a
       new authentication mechanism.

to a requirement:

    REQ-11:  A widely deployed authentication technique with known security
       properties MUST be selected as the authentication mechanism within PCP.

I'd also add another recommendation:

    REQ-11-A:  It is RECOMMENDED to choose an extensible authentication
       technique to ensure PCP authentication can adapt to future authentication
       methods.

This may be obvious to WG members who've followed the authentication 
discussion to date but it's not clear by looking at the PCP 
authentications requirements draft. The draft leaves open the 
possibility of inventing a new authentication technique and I think that 
would be a distraction and a waste of time.

-Ben McCann